For those familiar with NYDFS cyber regulations then enclosed is an important proposed update to the current regulations that impact NYDFS covered…

← Back to Blog

For those familiar with NYDFS cyber regulations then enclosed is an important proposed update to the current regulations that impact NYDFS covered entities. It significantly update current cyber regulations for Financial Institutions and aligns it closely with other cyber regulatory proposals such as that proposed by the SEC.

The proposals could require covered entities to;
1. Implement a CyberSecurity program based upon an entity’s risk assessment.
2. Update risk assessments annually.
3. Undertake an independent audit of their cybersecurity program.
4. Update, maintain and have board of director approval of an entities cybersecurity policies and procedures.
5. Designate a qualified CISO, responsible for overseeing and implementing the entities cybersecurity program. Who will report to the cybersecurity risk, compliance, material cyber issues to the board.
6. Executive management will develop, implement and maintain an entities cybersecurity program.
7. Conduct risk based penetration testing and bi-annual vulnerability assessments. Reporting gaps to senior management.
8. Maintain an up to date asset inventory.
9. Report cyber incidents, defined by NYDFS no later than 72 hours. Including unauthorized use of PAM accounts and deployment of ransomware.
10. Submit written certification of regulatory compliance signed by the CEO and CISO.
11. Submit an explanation of an extortion payment (including ransomware) within 24 hours and within 30 days as to the reason for the payment.

Apologies for the length of the post. But this is a further example of regulatory alignment and the adoption of cybersecurity risk management oversight and assurance. Compliance obligations to NYDFS have been underwritten with significant fines over the past 5 years. The updated proposals add further requirements for covered entities and strengthen the role of boards and CISOs for regulatory compliance oversight and assurance of cybersecurity risk management.

Ted Dziekanowski

#cybersecurity #cyberriskmanagement #cyberregulation #governance #nydfs #theaugustagroup

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A6960152147682324480